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DETAILED ACTION 

1. Amendment received on 05/24/2010 has been entered into record. Claims 1, 12 and 17 
are amended. Claims 1-20 are currently pending. 

2. Applicant's submission filed on 1 1/25/2009 was entered. No claim was amended. 

3. Amendment received on 04/30/2009 was entered into record. Claims 1, 12 and 17 were 
amended. 

4. Applicant's submission filed on 02/09/2009 was entered. The amendment to the 
specification to change the title of application was reviewed and accepted. Claims 1,12 and 17 
were amended. 

5. Amendment received on 08/20/2008 has been entered into record. Claims 1, 12-13 and 
17-20 are amended. 

Priority 

6. This application has claimed priority from provisional application 60528643 filed on 
12/10/2003. The filing date is 03/30/2004. 
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Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art 
to which said subject matter pertains. Patentability shall not be negatived by the manner in 
which the invention was made. 

Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley et al. (US 
7277957 B2), hereinafter referred as Rowley and further in view of Saulpaugh et al. (US 
7072967 Bl), hereinafter referred as Saulpaugh. 

a. Rowley shows (claim 1) an apparatus (Fig. 1 and Fig. 2) comprising: a network 
interface module to connect the apparatus to a network (column 3, lines 28-33; 
Ethernet card as a network tap device); a packet capture module to intercept packets 
being transmitted on the network (column 3, lines 33-35: a packet capture engine); an 
object assembly module to reconstruct flows representing objects being transmitted 
on the network from the intercepted packets (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved; column 4, lines 29-34: data from the selected packets may 
be reconstructed into data files and script files used to display web pages and other 
content; column 6, lines 59-65: local cache holding word processing documents, PDF 
files, audio files and video files), the packets associated with a document (column 4, 
lines 29-34: packets reconstructed into data and script files for web pages and other 
contents), wherein objects are captured based on a capture rule that specifies the 
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objects, and wherein a determination is made as to whether to discard or to store the 
objects (column 3, lines 62-67: packet not needed for the subsequent reconstruction 
of the network communication session; claim 1 : capture packets based on a set of 
criteria); an object classification module to determine a type of content of the objects 
(column 4, lines 63-65: determine the type of packets; column 6, lines 6-11: packet 
indicates a script file type to be displayed as page, e.g. HTML, Java Script and Active 
Server Pages; multi-packet recompilation module set similar directories for local 
cache of files) and to reconstruct the objects from flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files); an object store 
module to store the objects (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has been 
retrieved), wherein a location for storing the objects is determined based at least in 
part on the type of content for each of the objects (column 4, lines 29-41 : packets are 
extracted and used to create storing cache files and directory structures for 
reconstructing network communication session; column 6, lines 38-48: directory 
structure based on image file type; column 6, lines 49-65: directory structure for 
graphics files, text files, audio files and video files); and a user interface to enable a 
user to search objects stored in the object store module (column 7, line 66-column 8, 
line 1 : web browser or display program capable display text, graphic and other visual 
information on a computer monitor). Rowley , o " ^ ^ (claim 1) the 
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document includes the objects; wherein the objects are searched based a query, which 
includes search criteria used to identify selected objects that match the search criteria. 
Rowley does show (claim 1 ) hov, c\ ei using browser to search and identify objects 
based upon search criteria seems to be known to one skill in the art. 

b. Saulpaugh shows reconstructing objects from XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) 

purpose of efficient construction of message endpoints. 

c. It would have been obvious to a person of ordinary skill in the a? t at the time of the 
invention was made to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of reconstructing objects from XML 
data stream and message query based on name or string. 

d - v %v been obvious because one of ordinary skill in the art 

would have been motivated to data selection or query based on name or string as per 
Saulpaugh's teaching in support the display of data collected and reconstructed as per 
Rowley (column 1, lines 54-65) and Saulpaugh (column 82, lines 28-52)'s teaching. 

e. Regarding claim 2, Rowley shows wherein the object assembly module comprises a 
reassembler to assemble the intercepted packets into flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
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until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files). 

f. Regarding claim 3, Rowley shows wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol (column 
4, lines 9-12: packets are sequentially read, decoded, checked and added to the 
protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 4, Rowley shows wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

h. Regarding claim 5, Rowley shows wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session; claim 1 : capture packets based 
on a set of criteria). 

i. Regarding claim 6, Rowley shows wherein the capture rules are user-configurable 
through the user interface (column 1, line 66-column 2, line 9: selecting a portion of 
the packets captured by a sniffer during a giving time interval; column 3, lines 43-47: 
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selecting captured data during a specified time interval; claim 1 : capture packets 
based on a set of criteria), 
j. Regarding claim 7, Rowley shows wherein the object classification module 

determines a location that each object is stored in the object store based on the type of 
content of each object (column 4, lines 29-41 : packets are extracted and used to create 
storing cache files and directory structures for reconstructing network communication 
session; column 6, lines 38-48: directory structure based on image file type; column 
6, lines 49-65: directory structure for graphics files, text files, audio files and video 
files). 

k. Regarding claim 8, Saulpaugh shows wherein the object classification module 

determines the type of content of each object using a signature of each object (column 
82, lines 28-52: an object signature may be included to identify the object's class). 
1. Regarding claim 9, Rowley shows wherein the user interface comprises a graphical 
user interface (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Together Rowley and Saulpaugh disclosed all limitations of claims 1-9. Claims 1-9 are 
rejected under 35 U.S.C. 103(a). 
8. Claims 10-11 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley, 
Saulpaugh and further in view of Barnett et al. (US 7290048 Bl), hereinafter referred as Barnett. 
a. Rowley show s claim 1 as above. Neither Rowley nor Saulpaugh shows (claim 10) 
wherein the object store module comprises a content store to store the objects and a 
tag store to index the objects stored in the object store. However, Rowley does show 
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identifying protocol and collecting packets into a protocol sorted list; selecting, 
reconstructing and displaying data information, e.g. web pages, from a protocol 
session. 

b. Barnett shows (claim 10) wherein the object store module comprises a content, store 
to store the objects and a tag store to index the objects stored in the object store 
(column 10, lines 52-61 : tags and other columns support transaction recognition, 
pointer to original sources of data for traceability; column 22, lines 18-37: tags 
interpreted are time, data, fde name, line numbers, graph object types, source, 
destination and tool tip information) <: \ o o\ t. data 
collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. It would have been obvious to a person of ordinary skill in the art 

• s 0! ■ ; v as nade to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of message query based on name or 
string and Barnett' s functions of using tags in support of performance analysis. 

d obvious because one of ordin a :> Ciii o\ <k .>st 

v \ vo % " v o tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1, lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

e. Regarding claim 11, Barnett shows wherein the content store comprises a canonical 
storage, and the tag store comprises a database (column 12, lines 4-12: canonical 
form for abstract module, sources supply lines information form text file, binary file 
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or database; column 13, lines 26-48: data consists of network traces consisting of 
arrays mutated into hash tables to be addresses by column header vs. row and column 
locations). 

Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 10-11. Claims 
10-11 are rejected under 35 U.S.C. 103(a). 

9. Claims 12-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley in 

view of Saulpaugh and Barnett. 

a. Rowley shows (claim 12) an method comprising: intercepting data being transmitted 
on a network (column 3, lines 33-35: a packet capture engine); reconstructing flows 
of objects being transmitted on the network from the intercepted data (column 4, lines 
9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 4, lines 29-34: data from 
the selected packets may be reconstructed into data files and script files used to 
display web pages and other content; column 6, lines 59-65: local cache holding word 
processing documents, PDF files, audio files and video files); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages) ), the data associated with a 
document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents), wherein objects are captured based on a capture rule 
that specifies the objects, and wherein a determination is made as to whether to 
discard or to store the objects (column 3, lines 62-67: packet not needed for the 
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subsequent reconstruction of the network communication session; claim 1 : capture 
packets based on a set of criteria); and storing the classified objects (column 4, lines 
9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved). Rowley >i- \> n^f sh^w (claim 12) 
the document includes the objects; creating a tag to describe each reconstructed 
object; storing tags; indexing the stored objects to enable searching of the stored 
objects via the tags, wherein the content type of the objects is used in the indexing 
and wherein the objects are searched based on a query, which includes search criteria 
used to identify selected objects that match the search criteria. However, Rowley does 
show (column 4, lines 29-41) packets being extracted and used to create storing cache 
files and directory structures for reconstructing network communication session; 
identifying protocol and collecting packets into a protocol sorted list as per IP address 
and port number to categorize packets (column 4, lines 42-65); (column 6, lines 38- 
4): directory structure based on image file type; selecting, reconstructing and 
displaying data information, e.g. web pages, from a protocol session, including the 
directory and file structures (column 7, lines 37-51). 
b. Barnett shows (claim 12) creating a tag to describe each reconstructed object; storing 
tags; storing tags; indexing the stored objects to enable searching of the stored objects 
via the tags (column 10, lines 52-61 : tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information) 1 j!-v;,oi^ ,mt 
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data collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. Saulpaugli shews reconstructing objects from XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) in an analogous art toi the 
purpose efficient construction of message endpoints. 

d. It svould have been obvious to a person of ordinary si ill in th . irt it the time of the 
invention was made to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of reconstructing objects from XML 
data stream and message query based on name or string and Barnett's functions of 
using tags in support of performance analysis. 

e. The modification would have been obvious because one of ordinaiy skii ! n the art 
wouki h>n o Ivon n:o;n ar«.d to tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1, lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

f. Regarding claim 13, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
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local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 14, Rowley shows further comprising determining whether each 
object is to be stored based on a set of one or more capture rules (column 3, lines 62- 
67: packet not needed for the subsequent reconstruction of the network 
communication session; claim 1 : capture packets based on a set of criteria). 

h. Regarding claim 15, Saulpaugh shows further comprising receiving a query over the 
stored objects (column 27, lines 10-29: query for a message response). 

i. Regarding claim 16, Saulpaugh -.;;<;w - further comprising searching the indexed 
objects, and retrieving objects matching the query (column 41, line 60-column 42, 
lines 10: database query based upon name or strings; column 48, lines 33-52: query 
results cache); 

j. Regarding claim 17, Rowley shows an machine-readable storage medium having 
stored thereon data representing instructions (Fig. 1 and Fig. 2) that, when executed 
by a processor, cause the processor to perform operations comprising: intercepting 
data being transmitted on a network (column 3, lines 33-35: a packet capture engine); 
reconstructing objects being transmitted on the network from the intercepted data 
(column 4, lines 29-34: data from the selected packets may be reconstructed into data 
files and script files used to display web pages and other content); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages), the data associated with a 
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document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents) identifying characteristic of the document (column 5, 
lines 28-37: indicates a file with characteristics), wherein objects are captured based 
on a capture rule that specifies the objects, and wherein a determination is made as to 
whether to discard or to store the objects (column 3, lines 62-67: packet not needed 
for the subsequent reconstruction of the network communication session; claim 1 : 
capture packets based on a set of criteria); storing the classified objects (column 4, 
lines 9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved). Rowley a ho .show* (column 4, 
lines 29-41) packets are extracted and used to create storing cache files and directory 
structures for reconstructing network communication session; (column 6, lines 38-48) 
directory structure based on image file type; and (column 6, lines 49-65) directory 
structure for graphics files, text files, audio files and video files, 
k. Saulpaugh shew s reconstructing objects from XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9). Barnett shows creating a tag to 
describe each reconstructed object; storing tags; storing tags; indexing the stored 
objects to enable searching of the stored objects via the tags, wherein the content type 
of the objects is used in the indexing (column 10, lines 52-61 : tags and other columns 
support transaction recognition, pointer to original sources of data for traceability; 
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column 22, lines 18-37: tags interpreted are time, data, file name, line numbers, graph 
object types, source, destination and tool tip information). Claim 17 is of substantially 
same scope as claim 12. Thus the reasoning and motivation to combine of Rowley, 
Saulpaugh and Bameet as applied to claim 12 apply to claim 17. 
1. Regarding claim 18, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

m. Regarding claim 19, Rowley shows wherein the instructions further cause the 
processor to determine whether each object is to be stored based on a set of one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session; claim 1 : capture packets based 
on a set of criteria). 

n. Regarding claim 20, Saulpaugh shows wherein the instructions further cause the 
processor to receive a query over the stored objects, search the indexed objects in 
response to the query, and retrieve objects matching the query (column 27, lines 10- 
29: query for a message response; column 41, line 60-column 42, lines 10: database 
query based upon name or strings; column 48, lines 33-52: query results cache). 

Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 12-20. Claims 

12-20 are rejected under 35 U.S.C. 103(a). 
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Response to Arguments 

10. Applicant's arguments filed on 05/24/2010 have been fully considered, but they are not 
persuasive. 

a. Applicant has argued the limitation of "the packets associated with a document that 
includes the objects, wherein the document is captured based on a capture rule that 
specifies the objects, and wherein a determination is made as to whether to discard or 
to store the objects of the document" (see 3 rd paragraph on page 8 through 2 nd 
paragraph on page 9 of current Amendment). This is similar to an argument in page 9 
of Amendment received on 1 1/25/2009 and 3 ld paragraph on page 8 through last 
paragraph on page 9 of a previous amendment received on 10/20/09. An Advisory 
Action was issued on 1 1/09/2009 in response to the argument as per Amendment 
received on 10/20/09, 

b. Applicant did not amend claim set. Applicant has repeated a similar argument as per 
3 rd paragraph on page 8 through last paragraph on page 9 of a previous amendment 
received on 10/20/09 (see last paragraph on page 8 through last paragraph on page 9 
of current amendment). An Advisory Action was issued on 1 1/09/2009 in response to 
the argument as per previous amendment. A further response on the arguments is 
noted in item 'b' of Response to Arguments in Office Action mailed on 02/23/2010. 
Examiner has reviewed the limitation with respect to the claimed invention as whole 
and in light of applicant's original specification and claim set. Examiner has reviewed 
the applied prior arts, particularly Rowley. Rowley has stated capturing network 
packets based on a predetermined set of criteria in its claims 1, 6 and 12-13. Rowley 
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has disclosed also selecting a portion of packets captured by a sniffer during a given 
time interval (column 1, line 61 through column 2, line 8) and the process of 
capturing network packets is known in the art and commonly available software 
capture engines include the Sniffer, Lanalyzer, EtherPeek and Ethereal as described 
in an applicant's IDS item Etherreal User's Guide" (received on 08/20/2008). Thus 
examiner did conclude that the ability to identify the contents to be captured is well 
known and disclosed by Rowley and Saulpaugh as applied to reconstruct objects from 
XML data stream per Saulpaugh 's teaching and are also disclosed as a filter function 
specified in Chapter 3 with specific filer fields definitions for various known 
protocols in Appendix A of "Etherreal User's Guide". 

c. Applicant has further amended independent claims with the limitation of "wherein a 
location for storing the objects is determined based at least in part on the type of 
content for each of the objects" and argued that the applied prior does not have the 
limitation. Examine has reviewed claim rejections as per Office Action mailed 
02/23/2010 with respect to the amended limitation. Examiner has searched and found 
the Rowley has disclosed (column 4, lines 29-41) packets are extracted and used to 
create storing cache files and directory structures for reconstructing network 
communication session and (column 6, lines 38-48) a directory structure based on file 
type (content type) of images. 

d. Claim rejections are updated to reflect these findings. 
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Conclusion 

1 1 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy 
as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO MONTHS 
of the mailing date of this final action and the advisory action is not mailed until after the end 
of the THREE-MONTH shortened statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 
1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

12. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peling A. Shaw whose telephone number is (571) 272-7968. The 
examiner can normally be reached on M-F 8:00-4:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William C. Vaughn can be reached on (571) 272-3922. The fax phone number for 
the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the statu9s of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
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